RHSA-2026:56130: Important: sg3_utils security, bug fix, and enhancement update
Important: sg3utils security, bug fix, and enhancement update
Other sources
The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface (SCSI) command sets.Security Fix(es): sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export (CVE-2026-16313) Bug Fix(es) and Enhancement(s): sginq output conformance for SCSI name string and ATA fields [rhel-8.10.z] (JIRA:RHEL-188162) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sg3_utilsto a version that resolves this vulnerability.Fixed in rhel-8.10.zPatch RHEL-188162 - Upgrade
Upgrade
sg3_utilsto a version that resolves this vulnerability.Patch CVE-2026-16313
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the affected sg3_utils packages on the listed Red Hat Enterprise Linux architectures, including corresponding Extended Life Cycle offerings, are in scope. The issue is specifically associated with the sg_inq utility when used with the --export option.
What capability does an attacker gain, and what is required to exploit it?
Exploitation involves udev property injection through sg_inq --export and can result in arbitrary command execution. The advisory does not state the required attacker access level, whether this can be triggered remotely, or whether the affected invocation is used by default.
What should administrators do if they cannot patch immediately?
Apply the sg3_utils security update provided by RHSA-2026:56130. If immediate patching is not possible, the provided information supports avoiding use of sg_inq with the --export option; no other mitigations are specified.